Archivecryptography
Ring Signatures: Sign on Behalf of a Set
A signature proves a member of a group signed, without revealing which one. Anonymity with a fixed cost.
- Published
- Reading time
- 1 min read
A ring signature binds a message to a set of public keys. A verifier learns that some key in the set signed, but not which. Unlike group signatures, there is no manager and no way to revoke anonymity.
How it feels
- Signer picks a ring (their key plus others' public keys).
- Produces a signature valid for the whole ring.
- Verification checks the ring, not an identity.
Trade-offs
- Anonymity set size = ring size, chosen by the signer. A ring of two hides little.
- Signatures grow with ring size in classic constructions (LSAG, MLSAG).
- No accountability: no opener, so misuse cannot be attributed.
- Linkability: some schemes reveal when two signatures came from the same signer (linkable ring signatures).
Uses
Anonymous credentials, whistleblowing, some privacy coins (Monero uses a linkable variant), and anonymous voting components.
Takeaway: ring signatures give plausible deniability, not unlinkability across contexts. Size the ring and check whether linkability is acceptable.